openstack/puppet-tripleo
Code Issues Proposed changes

Set ProxyPreserveHost in ec2api TLS proxy

Browse Source 
bp tls-via-certmonger-containers

Change-Id: Iae8e61cb5be4faeea8861296629dd6a5f3ed4f01
This commit is contained in:
Oliver Walsh
2017-11-23 10:47:15 +00:00
parent 88128ef20e
commit 26e053153b
2 changed files with 24 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
manifests/profile/base/nova/ec2api.pp
View File

@@ -117,6 +117,7 @@ class tripleo::profile::base::nova::ec2api (
port => $ec2_api_tls_proxy_port, port => $ec2_api_tls_proxy_port,
tls_cert => $ec2_api_tls_certfile, tls_cert => $ec2_api_tls_certfile,
tls_key => $ec2_api_tls_keyfile, tls_key => $ec2_api_tls_keyfile,
preserve_host => true,
} }
Tripleo::Tls_proxy['ec2-api'] ~> Anchor<| title == 'ec2api::service::begin' |> Tripleo::Tls_proxy['ec2-api'] ~> Anchor<| title == 'ec2api::service::begin' |>

7
manifests/tls_proxy.pp
View File

@@ -33,12 +33,18 @@
# [*tls_key*] # [*tls_key*]
# The path to the key used for the specified certificate. # The path to the key used for the specified certificate.
# #
# [*preserve_host*]
# (Optional) Whether the Host header is perserved in proxied requests.
# See the Apache ProxyPreserveHost directive docs.
# Defaults to false
define tripleo::tls_proxy( define tripleo::tls_proxy(
$ip, $ip,
$port, $port,
$servername, $servername,
$tls_cert, $tls_cert,
$tls_key, $tls_key,
$preserve_host = false
) { ) {
include ::apache include ::apache
::apache::vhost { "${title}-proxy": ::apache::vhost { "${title}-proxy":
@@ -52,6 +58,7 @@ define tripleo::tls_proxy(
ssl_cert => $tls_cert, ssl_cert => $tls_cert,
ssl_key => $tls_key, ssl_key => $tls_key,
request_headers => ['set X-Forwarded-Proto "https"'], request_headers => ['set X-Forwarded-Proto "https"'],
proxy_preserve_host => $preserve_host,
proxy_pass => { proxy_pass => {
path => '/', path => '/',
url => "http://localhost:${port}/", url => "http://localhost:${port}/",